How to switch user in debug container?

Patrick 5

The documentation about debug containers mentions that it is possible to switch the user inside the debug container by running the following command:

switch-to-app-user

Full quote:

By default, debug console runs as root user. You can access /proc/1 to access container's file system if your container runs as root user. If your container doesn't run as root user, run below command to switch user before accessing /proc/1 directory, or you'll get a permission denied error.

However, unfortunately, the command is not available within the debug container:

bash: switch-to-app-user: command not found

Steps to reproduce:

az containerapp debug --name [APP] --resource-group [RG]
run switch-to-app-user
access /proc/1/root without error

Do I miss something?

Shireesha Eeraboina 1,800 Reputation points Microsoft Vendor

2025-02-19T07:07:40.68+00:00
Hi @Patrick,

Welcome to Microsoft Q&A Platform!

To switch users in the debug container, you should use the command switch-to-app-user. If you see the error bash: switch-to-app-user: command not found, it means that this command isn't available in your current debug container.

Make sure your container is set up properly and that you're using a container image that supports this command. If the command is missing, you might need to check the container's configuration or try using a different image that includes this feature.

To help you better understand, kindly refer to the documentation below:

Connect to a container debug console in Azure Container Apps

I hope this is helpful! Feel free to reach out if you have any more questions or need further assistance.
Patrick 5 Reputation points

2025-02-19T08:00:26.03+00:00
Thanks for your quick response.

Make sure your container is set up properly and that you're using a container image that supports this command.

Unfortunately, I have no control over the container image that is used. The debug container is initialized transparently by Azure after running:

az containerapp debug --name [APP] --resource-group [RG]
Shireesha Eeraboina 1,800 Reputation points Microsoft Vendor

2025-02-20T05:29:58.2166667+00:00
Hi @Patrick,

Thank you for your response! I understand that you don't have control over the container image, you can use the Azure CLI to connect to the container console and carry out the necessary actions. Here’s how to do it:

Use the following Azure CLI command to access the container console:

az containerapp exec --name [APP] --resource-group [RG]

Make sure to replace [APP] with the name of your container app and [RG] with your resource group.

Once you're connected to the console, you can navigate through the file system and perform the required actions. If your container is running as a non-root user, you might need to use commands like sudo to access certain directories.

By following these steps, you should be able to troubleshoot and perform the necessary actions within the debug container without needing the switch-to-app-user command.

If you have any further questions or need additional assistance, feel free to ask.
Shireesha Eeraboina 1,800 Reputation points Microsoft Vendor

2025-02-21T08:27:06.6333333+00:00

Hi @Patrick,

Just checking in to see if the information above was helpful. If you have any further updates on this issue, please feel free to post them here.
Patrick 5 Reputation points

2025-02-21T09:50:41.4033333+00:00

By following these steps, you should be able to troubleshoot and perform the necessary actions within the debug container without needing the switch-to-app-user command.

Unfortunately, I can't use the container console directly as the container is using a distroless image (created with buildpacks). From my understanding, this is one of the described use cases for the container debug console:

Azure Container Apps platform offers a debugging console to help you troubleshoot your application under the following circumstances: You can't connect to the target container when you use a container that only includes the application and its runtime dependencies, or a "distroless" image.

Is the source code of the command switch-to-app-user available to the public? If yes, I could copy the command to the debug console and run it.
Shireesha Eeraboina 1,800 Reputation points Microsoft Vendor

2025-02-27T10:53:30.63+00:00

Hi Patrick

The source code for certain Azure commands, like "switch-to-app-user," is usually not available to the public. Azure services often use proprietary code, and while some parts may be open source, many commands and features are kept private to protect intellectual property and security.
Patrick 5 Reputation points

2025-02-27T11:01:49.51+00:00

Hi Shireesha

Thank you for your response and explanation. By any chance, do you know if there are plans to add the command to the debug container?

Accepted answer

Bowen Wan 0 Reputation points Microsoft Employee

2025-02-28T09:27:40.7+00:00

Hi Patrick,

This is Bowen from Azure Container Apps production group. Please use "switch-user" as replacement for this command. We will update our doc soon to reflect this change. Sorry about the confusion.
Please sign in to rate this answer.

2 people found this answer helpful.
Patrick 5 Reputation points

2025-02-28T10:38:27.5033333+00:00

Hi Bowen,

Thanks a lot! "switch-user" works perfectly.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to switch user in debug container?

0 additional answers

Your answer